Palo Alto Networks Agentic Access

x-agentic-access generated
Palo Alto Networks exposes 526 API operations that an AI agent could call, of which 269 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 257 read, 259 write, 5 physical, and 5 safety-critical.
5 operations are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR
Operations: 526 Acting: 269 Human-in-the-loop: 5 Method: generated
By consequence

read 257 write 259 physical 5 safety-critical 5
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
PUT	/api/cloud/2.0/agg/notifications/profiles/opstate	safety-critical	required
PUT	/api/v1/user/{username}/credential	safety-critical	required
POST	/api/v1/user/{username}/credential/reset-token/validate	safety-critical	required
POST	/mobile-agent/infrastructure-settings	safety-critical	required
DELETE	/service-accounts/{id}/keys/{key_id}	safety-critical	required
POST	/mt/sp-interconnect/interconnects/physical-connections	physical	conditional
POST	/mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments	physical	conditional
POST	/v1/deployments	physical	conditional
PUT	/v1/deployments/{deployment_id}	physical	conditional
DELETE	/v1/deployments/{deployment_id}	physical	conditional
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/palo-alto-aiops-ngfw-bpa-api-openapi-original.yml, openapi/palo-alto-autonomous-dem-api-openapi-original.yml,
  openapi/palo-alto-cloud-identity-engine-api-openapi-original.yml, openapi/palo-alto-cloud-ngfw-api-openapi-original.yml,
  openapi/palo-alto-cortex-xdr-api-openapi-original.yml, openapi/palo-alto-cortex-xpanse-api-openapi-original.yml,
  openapi/palo-alto-cortex-xsiam-api-openapi-original.yml, openapi/palo-alto-cortex-xsoar-api-openapi-original.yml,
  openapi/palo-alto-dlp-api-openapi-original.yml, openapi/palo-alto-dns-security-api-openapi-original.yml,
  openapi/palo-alto-email-dlp-api-openapi-original.yml, openapi/palo-alto-identity-security-posture-management-api-openapi-original.yml,
  openapi/palo-alto-iot-security-api-openapi-original.yml, openapi/palo-alto-pan-os-rest-api-openapi-original.yml,
  openapi/palo-alto-prisma-access-api-openapi-original.yml, openapi/palo-alto-prisma-access-browser-api-openapi-original.yml,
  openapi/palo-alto-prisma-access-insights-api-openapi-original.yml, openapi/palo-alto-prisma-airs-ai-red-teaming-api-openapi-original.yml,
  openapi/palo-alto-prisma-airs-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-code-security-api-openapi-original.yml,
  openapi/palo-alto-prisma-cloud-compute-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-cspm-api-openapi-original.yml,
  openapi/palo-alto-prisma-cloud-dspm-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-mssp-api-openapi-original.json,
  openapi/palo-alto-prisma-sd-wan-api-openapi-original.yml, openapi/palo-alto-saas-security-api-openapi-original.yml,
  openapi/palo-alto-sase-5g-api-openapi-original.yml, openapi/palo-alto-sase-5g-monitor-api-openapi-original.yml,
  openapi/palo-alto-sase-aggregate-monitoring-api-openapi-original.yml, openapi/palo-alto-sase-config-orchestration-api-openapi-original.yml,
  openapi/palo-alto-sase-iam-api-openapi-original.yml, openapi/palo-alto-sase-multitenant-interconnect-api-openapi-original.yml,
  openapi/palo-alto-sase-multitenant-notifications-api-openapi-original.yml, openapi/palo-alto-sase-subscription-api-openapi-original.yml,
  openapi/palo-alto-sase-tenancy-api-openapi-original.yml, openapi/palo-alto-security-advisory-api-openapi-original.yml,
  openapi/palo-alto-sspm-api-openapi-original.yml, openapi/palo-alto-strata-cloud-manager-api-openapi-original.yml,
  openapi/palo-alto-strata-logging-service-api-openapi-original.yml, openapi/palo-alto-threat-vault-api-openapi-original.yml,
  openapi/palo-alto-wildfire-api-openapi-original.yml, openapi/palo-alto-ztna-connector-api-openapi-original.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 526
  by_action_class:
    acting: 269
    connected: 257
  by_consequence:
    write: 259
    read: 257
    safety-critical: 5
    physical: 5
  human_in_the_loop_required: 5
operations:
- path: /requests
  method: post
  operationId: submitBPARequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /requests/{request_id}
  method: get
  operationId: getBPARequestStatus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/{report_id}
  method: get
  operationId: getBPAReport
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/{report_id}/checks
  method: get
  operationId: getBPAReportChecks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/applications/scores
  method: get
  operationId: getApplicationScores
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/agents/scores
  method: get
  operationId: getAgentScores
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/tests/{test_id}/results
  method: get
  operationId: getTestResults
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/applications
  method: get
  operationId: listMonitoredApplications
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/agents
  method: get
  operationId: listMonitoredAgents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/metrics
  method: get
  operationId: getPerformanceMetrics
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/domains
  method: get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/cache-users
  method: post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/cache-groups
  method: post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks
  method: get
  operationId: listRuleStacks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks
  method: post
  operationId: createRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}
  method: get
  operationId: getRuleStack
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}
  method: put
  operationId: updateRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}
  method: delete
  operationId: deleteRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/commit
  method: post
  operationId: commitRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules
  method: get
  operationId: listSecurityRules
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/security-rules
  method: post
  operationId: createSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: get
  operationId: getSecurityRule
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: put
  operationId: updateSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: delete
  operationId: deleteSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/fqdnlists
  method: get
  operationId: listFqdnLists
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/fqdnlists
  method: post
  operationId: createFqdnList
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/prefixlists
  method: get
  operationId: listPrefixLists
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/prefixlists
  method: post
  operationId: createPrefixList
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls
  method: get
  operationId: listFirewalls
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/ngfirewalls
  method: post
  operationId: createFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls/{firewall}
  method: get
  operationId: getFirewall
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/ngfirewalls/{firewall}
  method: put
  operationId: updateFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls/{firewall}
  method: delete
  operationId: deleteFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incident_extra_data
  method: post
  operationId: getIncidentExtraData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/update_incident
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /alerts/get_alerts
  method: post
  operationId: getAlerts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/get_endpoints
  method: post
  operationId: getEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/isolate
  method: post
  operationId: isolateEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/unisolate
  method: post
  operationId: unisolateEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/scan
  method: post
  operationId: scanEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /scripts/run_script
  method: post
  operationId: runScript
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /scripts/get_script_execution_results
  method: post
  operationId: getScriptExecutionResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/start_xql_query
  method: post
  operationId: startXqlQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/get_query_results
  method: post
  operationId: getXqlQueryResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audit/get_audit_management_logs
  method: post
  operationId: getAuditManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/get_assets_internet_exposure
  method: post
  operationId: getAssetsInternetExposure
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/get_asset_internet_exposure
  method: post
  operationId: getAssetInternetExposure
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident_management/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident_management/update_incident
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /attack_surface_rules/get_attack_surface_rules
  method: post
  operationId: getAttackSurfaceRules
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /attack_surface_rules/update_attack_surface_rule
  method: post
  operationId: updateAttackSurfaceRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /services/get_services
  method: post
  operationId: getServices
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ip_range/get_owned_ip_ranges
  method: post
  operationId: getOwnedIpRanges
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audit/get_audit_management_logs
  method: post
  operationId: getAuditManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /alerts/get_alerts
  method: post
  operationId: getAlerts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/start_xql_query
  method: post
  operationId: startXqlQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/get_query_results
  method: post
  operationId: getXqlQueryResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/list_assets
  method: post
  operationId: listAssets
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/get_endpoints
  method: post
  operationId: getEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audits/management_logs/get_management_logs
  method: post
  operationId: getManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ingestion/datasources
  method: post
  operationId: configureDatasource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident
  method: post
  operationId: createIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/search
  method: get
  operationId: searchIncidentsGet
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/search
  method: post
  operationId: searchIncidentsPost
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident/{id}
  method: get
  operationId: getIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incident/update
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /entry
  method: post
  operationId: addEntry
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /investigations/{id}
  method: get
  operationId: getInvestigation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /investigation/add
  method: post
  operationId: createInvestigation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /playbook
  method: get
  operationId: listPlaybooks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /playbook/run
  method: post
  operationId: runPlaybook
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /integration/search
  method: get
  operationId: searchIntegrations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /settings/integration/search
  method: post
  operationId: searchIntegrationInstances
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents
  method: get
  operationId: listIncidents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/{incident_id}
  method: get
  operationId: getIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/{incident_id}
  method: put
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/{incident_id}/snippets
  method: get
  operationId: getIncidentSnippets
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /data-patterns
  method: get
  operationId: listDataPatterns
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /data-patterns/{id}
  method: get
  operationId: getDataPattern
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/summary
  method: get
  operationId: getReportSummary
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /domain
  method: get
  operationId: getDomain
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /domain/bulk
  method: get
  operationId: getDomainBulk
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stats/network
  method: get
  operationId: getNetworkStats
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents
  method: get
  operationId: listEmailIncidents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}
  method: get
  operationId: getEmailIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}/verdict
  method: put
  operationId: updateEmailIncidentVerdict
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /email-incidents/{id}/attachments
  method: get
  operationId: getEmailIncidentAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}/recipients
  method: get
  operationId: getEmailIncidentRecipients
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/catalog/{appType}
  method: get
  operationId: catalog_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps
  method: get
  operationId: idps_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps
  method: post
  operationId: idps_post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/accounts/logout
  method: get
  operationId: idps_accounts_logout_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/accounts/logout
  method: post
  operationId: idps_accounts_logout_post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/feature_state
  method: get
  operationId: idps_feature_state_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/idp_accounts/count
  method: get
  operationId: idps_idp_accounts_count_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report
  method: post
  operationId: idps_idp_accounts_csv_report_get
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity
  method: get
  operationId: idps_mfa_activity_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count
  method: get
  operationId: idps_mfa_activity_count_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type
  method: get
  operationId: idps_mfa_activity_count_by_app_type_get
  x-agentic-access:
    action-class: connected
    con

# --- truncated at 32 KB (151 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/agentic-access/palo-alto-networks-agentic-access.yml